Paper Free Finance legal
Privacy notice
Version 1.0 · Effective
This notice explains what personal data we hold about the people who use Paper Free Finance and the people whose details appear in the documents it processes, what we do with it and the rights you have under the UK GDPR and the Data Protection Act 2018.
1.Who we are
Paper Free Finance is provided by M Heath Consulting Ltd, trading as Usermode, a company registered in [country of registration: to be confirmed] under company number [company number: to be confirmed], whose registered office is at [registered office address: to be confirmed]. We are registered with the Information Commissioner's Office under number [ICO registration number: to be confirmed]. You can reach us about privacy at [privacy contact email: to be confirmed].
2.Our two roles
- Controller for the account data of the people who use Paper Free Finance (section 3): we decide how it is used to run the service.
- Processor for the data inside your organisation's documents and records (section 5): your organisation decides why it is processed, and we act on its instructions under the Data processing agreement. Questions about that data are best sent to the organisation first; we will help it answer.
3.What we collect about you
| Data | Where it comes from |
|---|---|
| Name, work email address, and your role in each organisation | You, or the person who invited you |
| Password (stored only as a salted hash), passkeys and two-factor settings | You, when you set them up |
| Sessions: when you signed in, your IP address and browser (user agent) | Your browser, each time you sign in |
| Audit records of what you did in Paper Free Finance, with the time, your IP address and browser | Paper Free Finance, as you use it |
| Which version of our terms you accepted, when, from which IP address and browser | You, when you tick the box or accept an update |
| Messages you send us, for example support requests | You |
| Billing contact details for your organisation | The person who sets up billing |
4.Why, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating your account, signing you in, running the service for your organisation, sending the emails the service depends on (invitations, password resets, approval requests) | Contract with your organisation, and our legitimate interest in providing the service it has asked for |
| Keeping the service secure: rate limits, fraud and abuse detection, investigating incidents | Legitimate interests (security of our service and of our customers' data) |
| The audit trail: a tamper-evident record of who did what, which your organisation and its auditors rely on | Legitimate interests (your organisation's accountability for its financial records), and legal obligations that require records to be kept |
| Recording acceptance of our terms | Contract, and our legitimate interest in being able to show what was agreed |
| Answering your questions and support requests | Legitimate interests |
| Billing and keeping our own accounts | Contract and legal obligation (tax records) |
We do not use your data for marketing profiles, and we do not sell it.
5.Data in your organisation's documents
The invoices and other documents your organisation processes contain personal data: names and contact details of suppliers' staff and of sole traders, bank details, and the names of the people who review and approve invoices. Paper Free Finance reads these documents to extract their fields, checks them, routes them for approval and posts them to your ledger. We process this data only on your organisation's instructions, under the Data processing agreement, and never for our own purposes.
Please do not send Paper Free Finance documents containing special category data (for example health information) that are not needed to pay a supplier.
7.Where it is processed
Paper Free Finance runs in Amazon Web Services' London region (eu-west-2). Your account data, your organisation's records and the archive of original documents are stored there, and email is sent through Amazon SES in London. UK-only deployments read documents through Claude models on Amazon Bedrock in London, without cross-region fallback. Other deployments may process requests in another AWS region in Europe through an EU inference profile, covered by the UK's adequacy regulations for the EEA.
Stripe processes billing details in Ireland and the United States. Anthropic's API, which is used only if your organisation opts in, processes documents in the United States. Transfers to the United States are protected by the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.
8.How long we keep it
| Data | How long |
|---|---|
| Your account | Until you or your organisation close it, then deleted within 30 days |
| Sessions | Until they expire (12 hours) or you sign out |
| Audit records | For the life of the organisation's records they describe (at least six years), because the audit trail is a hash chain: removing one event would break it. After your account closes, your user id and the IP address and browser recorded with each event stay in the chain; your name and email are removed from your account record. |
| Terms acceptance records | Six years after your account closes (the limitation period for contract claims) |
| Your organisation's documents and invoices | The retention period your organisation sets: six years by default, which is also the minimum (VAT Notice 700/21) |
| Backups | 35 days, then overwritten |
| Support messages | Two years after the conversation ends |
9.Security and breaches
We protect personal data with organisation-level isolation enforced by the database, encryption in transit and at rest with a separate key for each organisation, a write-once archive, and a signed audit trail. The security page describes these measures.
If a personal data breach is likely to put people's rights at risk, we will tell the organisations affected without undue delay and, where we are the controller, the Information Commissioner within 72 hours of becoming aware of it, and the people affected where the risk is high.
10.Your rights
You have the right to:
- ask for a copy of your personal data (access);
- have inaccurate data corrected;
- have data erased, where we have no lawful reason to keep it;
- restrict or object to processing based on our legitimate interests;
- receive data you gave us in a portable format;
- complain to the Information Commissioner.
Email [privacy contact email: to be confirmed]. We answer within one month, which can be extended by two further months for complex requests (we will tell you within the first month if so). We may ask you to confirm your identity first, usually by replying from the email address on your account. There is no charge.
Some data cannot be erased while the law or your organisation needs it: an organisation must keep its VAT records for at least six years, and its audit trail records who approved each payment. In that case we remove what we can (for example your name and email) and tell you what we have kept and why.
11.Automated processing
Paper Free Finance reads documents automatically and suggests coding, but it makes no decision about you that has legal or similarly significant effects without a person being involved: invoices are approved by people under the policies their organisation sets.
13.Changes to this notice
When we change this notice we publish the new version here with a new version number and date, and tell users by email when the change is significant.
14.Contact and complaints
Contact us at [privacy contact email: to be confirmed]. If you are unhappy with our answer you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or at ico.org.uk/make-a-complaint.